From ee6a11f9b01169e8e19495a8a0e236da5a2b66a3 Mon Sep 17 00:00:00 2001 From: Claude Opus 5 Date: Sat, 1 Aug 2026 18:46:47 +0200 Subject: [PATCH] #304: declare the font-list route's access rule explicitly MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The route-permission fence (#52) failed in CI, not locally: I had run the fonts and import-export suites, not the full api suite, and that fence needs a database. `@AuthenticatedOnly()` is the rule the route always meant — a session, no further permission. Re-verified with the FULL api suite against a fresh database: 103 files / 575 tests passed. --- apps/api/src/fonts/custom-fonts.controller.ts | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/apps/api/src/fonts/custom-fonts.controller.ts b/apps/api/src/fonts/custom-fonts.controller.ts index dbda4de..a4ea9ff 100644 --- a/apps/api/src/fonts/custom-fonts.controller.ts +++ b/apps/api/src/fonts/custom-fonts.controller.ts @@ -23,6 +23,7 @@ import type { Response } from 'express'; import { SiteAdminGuard } from '../admin/site-admin.guard'; import { AuthedRequest, Public } from '../auth/auth.guard'; +import { AuthenticatedOnly } from '../permissions/permission.decorators'; import { CustomFontStorageService } from './custom-font-storage.service'; import { CustomFontsService, WeightUpload } from './custom-fonts.service'; @@ -125,6 +126,10 @@ export class CustomFontsFileController { private readonly fonts: CustomFontsService, ) {} + // Explicit access declaration, as every route needs (issue #52's fence + // `route-permissions.e2e.db.test.ts`): a session, no further permission — + // the list says which families exist, which is what the pickers offer. + @AuthenticatedOnly() @Get() list(): Promise { return this.fonts.list();